By the composability and post-processing properties of differentially private mechanisms [1]}, the total privacy loss for an individual client's dataset in training of the server's model is equal to the sum of the loss of the scoring and classification models. The server model is \((\epsilon ,\delta )\) -differentially private, where
\(\epsilon = \epsilon _{scores} + \epsilon _{classes}\) 
\(\delta = \delta _{scores} + \delta _{classes}\) 
